AZ-104 Implement and Manage Virtual Networking Practice Test 16 — 15 Questions

Question 1

An NSG rule allows TCP 8443 from ASG-Web to ASG-Api on the API subnet. The web VM NIC is already in ASG-Web, but the API VM was only placed in the subnet and not added to ASG-Api. Traffic still fails. What is the best fix?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add the API VM's NIC to ASG-Api so the NSG rule can match the destination NIC.. The NSG rule specifies ASG-Api as the destination, but NSGs evaluate traffic based on the NIC membership in an ASG, not the subnet. Since the API VM's NIC is not added to ASG-Api, the rule cannot match the destination, so traffic is dropped by default (implicit deny). Adding the NIC to ASG-Api allows the NSG rule to correctly identify the destination and permit TCP 8443 traffic.

Answer

Add ASG-Api to the API subnet because ASGs are inherited from subnet membership.

Answer

Lower the rule priority number on the web subnet to make source traffic more specific.

Answer

Create a user-defined route from AppSubnet to API subnet to bypass the NSG.

Question 2

Based on the exhibit, a site-to-site VPN gateway deployment fails. What prerequisite should the administrator provide so the gateway can be created successfully?

Accepted Answer

A public IP address resource that will be associated with the VPN gateway.. A site-to-site VPN gateway in Azure requires a public IP address resource to be associated with it for the tunnel to be established. The VPN gateway uses this public IP as the endpoint for on-premises VPN devices to connect to over the internet. Without a public IP, the gateway cannot be provisioned because it has no routable external address for IPsec/IKE negotiation.

Answer

A NAT gateway on the GatewaySubnet to translate tunnel traffic.

Answer

A private endpoint in the GatewaySubnet for tunnel termination.

Answer

A network security group that allows inbound TCP 443 to the subnet.

Question 3

A VM in AppSubnet must reach a database VM in DbSubnet on TCP 1433. AppSubnet's NSG has an outbound deny rule for TCP 1433 to Any at priority 200. DbSubnet's NSG has an inbound allow rule for TCP 1433 from ASG-App to ASG-Db at priority 300. Both NICs are in the correct application security groups. Connectivity tests fail. What should the administrator change?

Accepted Answer

Create an outbound allow rule on AppSubnet with a lower priority number than 200 for TCP 1433 to ASG-Db.. The AppSubnet's NSG has an outbound deny rule for TCP 1433 to Any at priority 200, which blocks all outbound traffic on that port regardless of destination. To allow the VM in AppSubnet to reach the database VM in DbSubnet, an outbound allow rule must be created with a lower priority number (e.g., 100) so it is evaluated before the deny rule. This rule should specify the destination as ASG-Db (the application security group of the database VM) to precisely permit the required traffic.

Answer

Remove the inbound allow rule from DbSubnet so the default rules can take over.

Answer

Move the inbound allow rule on DbSubnet to priority 100 so it is evaluated sooner.

Answer

Assign the database VM NIC to ASG-App so the destination rule matches a broader group.

Question 4

Based on the exhibit, a help desk engineer cannot RDP from an approved admin subnet to a VM in Azure. What change should the administrator make so the connection is allowed?

Accepted Answer

Move Allow-RDP-Admin to a priority lower than 100.. The exhibit shows a deny rule with priority 100 that blocks all inbound traffic from the approved admin subnet, and an allow rule for RDP with a priority lower than 100 (e.g., 200). Since Azure Network Security Group (NSG) rules are evaluated in priority order (lowest number first), the deny rule at priority 100 is evaluated before the allow rule at a lower priority, thus blocking the RDP connection. To allow the RDP traffic, the administrator must move the Allow-RDP-Admin rule to a priority lower than 100 (e.g., 90) so it is evaluated before the deny rule.

Answer

Change the deny rule to use UDP instead of TCP.

Answer

Add the VM NIC to an application security group and leave the rules unchanged.

Answer

Delete the default AllowVNetInBound rule.

Question 5

An administrator creates a route table with a UDR for 10.20.0.0/16 and next hop type Virtual appliance. A VM in the subnet still does not send that traffic to the appliance. The route table contents are correct. What should be checked first?

Accepted Answer

Whether the route table is associated with the correct subnet.. The most common reason a UDR fails to take effect is that the route table is not associated with the subnet containing the VM. Even if the route table contents are correct, the VM's traffic will follow default system routes unless the route table is explicitly linked to the subnet. Association is a required step to override Azure's default routing behavior.

Answer

Whether the NSG has an outbound deny rule for port 80.

Answer

Whether the VM uses a managed identity.

Answer

Whether the virtual machine is in an availability set.

Question 6

Based on the exhibit, administrators can reach a web server from the approved subnet, but connections still fail. What is the most likely reason?

Accepted Answer

The deny rule has a higher priority and matches the traffic before the allow rule.. Network Security Groups (NSGs) evaluate rules in order of priority, where a lower priority number (e.g., 100) is evaluated before a higher number (e.g., 200). If a deny rule with a higher priority (lower number) matches the traffic before the allow rule, the traffic is blocked. In this scenario, the deny rule (priority 100) matches the source subnet and destination port 443 before the allow rule (priority 200) can permit it, causing connections to fail.

Answer

The allow rule is blocked because inbound rules are evaluated from highest priority number to lowest.

Answer

The destination port must be changed to 80 because NSGs cannot allow TCP 443.

Answer

The subnet requires a route table before HTTPS can be permitted.

Question 7

Based on the exhibit, which next hop will Azure use for traffic from the VM to 10.50.1.20?

Accepted Answer

Internet, because the /24 route is more specific than the default route.. Azure uses the most specific route (longest prefix match) to determine next hop. The route for 10.50.1.0/24 with next hop Internet is more specific than the default route 0.0.0.0/0, so traffic to 10.50.1.20 will be forwarded to the Internet, not the virtual appliance.

Answer

Virtual appliance 10.1.1.4, because all traffic always follows the default route.

Answer

Virtual network, because private IP addresses always stay inside Azure.

Answer

No route is selected, so the packet is dropped before leaving the subnet.

Question 8

Backend VMs are rebuilt often and get new private IP addresses. Frontend VMs must reach them only on TCP 8443, and the rule should keep working after rebuilds. Which two actions should the administrator take? Select two.

Accepted Answer

Place the backend NICs in an ASG named ASG-Backend.. An Application Security Group (ASG) allows you to group backend VMs by their NICs, regardless of their private IP addresses. When backend VMs are rebuilt and receive new IPs, the ASG membership remains intact, so NSG rules referencing the ASG continue to work without manual updates. This decouples security rules from dynamic IP addresses.

Answer

Create a static route for the backend subnet to preserve the same IPs.

Answer

Use a service endpoint between the two subnets.

Answer

Add a load balancer health probe rule on TCP 8443 only.

Question 9

An existing application in AppSubnet1 must access an Azure Storage account. The team does not want to add a private endpoint or change DNS records, but they do want to allow access only from AppSubnet1. Which configuration should the administrator use?

Accepted Answer

Enable the Microsoft.Storage service endpoint on AppSubnet1 and restrict the storage account to selected virtual networks.. Enabling the Microsoft.Storage service endpoint on AppSubnet1 allows traffic from that subnet to be routed directly to the Azure Storage service over the Azure backbone network, bypassing the internet. By then restricting the storage account's firewall to 'selected virtual networks' and adding AppSubnet1's virtual network and subnet, access is limited exclusively to that subnet without needing a private endpoint or DNS changes.

Answer

Create a private endpoint and remove all public network access from the storage account.

Answer

Add a network security group rule that allows outbound TCP 443 to the storage account.

Answer

Enable peering between AppSubnet1 and the storage account network.

Question 10

Two application teams created separate VNets for independent workloads. VNet-A uses 10.40.0.0/16 and VNet-B uses 10.40.128.0/17. The teams want to peer the VNets so both apps can communicate privately. What should the administrator do first?

Accepted Answer

Renumber one VNet so its address space no longer overlaps before creating the peering.. B is correct because Azure VNet peering requires non-overlapping address spaces. VNet-A (10.40.0.0/16) and VNet-B (10.40.128.0/17) overlap, as 10.40.128.0/17 is a subset of 10.40.0.0/16. Before peering can be established, one VNet must be renumbered to eliminate the overlap; otherwise, the peering creation will fail with an error indicating overlapping address spaces.

Answer

Create the peering now and add a route table to one VNet later.

Answer

Add an NSG rule that allows traffic between the two address ranges.

Answer

Enable gateway transit on both VNets so overlapping ranges can route through a shared gateway.

Question 11

An app on a VM must connect to Azure SQL Database without using the public endpoint. The database name must resolve to a private IP inside the VNet, and public network access should be disabled. Which two actions should the administrator take? Select two.

Accepted Answer

Create a private endpoint for the Azure SQL server in the VNet.. A private endpoint assigns the Azure SQL Database server a private IP address from the VNet, allowing the VM to connect without using the public endpoint. This ensures traffic stays within the Microsoft backbone and the database name resolves to a private IP inside the VNet.

Answer

Enable a service endpoint for Microsoft.Sql on the subnet.

Answer

Grant the VM's managed identity Reader on the SQL server.

Answer

Keep public network access enabled and restrict the firewall to the VNet.

Question 12

Based on the exhibit, web servers can reach a backend VM only after it is added to a specific group. What should the administrator change to allow the traffic to match the existing NSG rule?

Accepted Answer

Add api01's NIC to ASG-Api.. The exhibit shows that the NSG rule allows traffic from ASG-Web to ASG-Api. Since web01 is in ASG-Web, traffic from web01 to api01 is only permitted if api01 is a member of ASG-Api. Adding api01's NIC to ASG-Api ensures the destination matches the NSG rule, allowing the traffic.

Answer

Move the deny rule to priority 100.

Answer

Change the source of the allow rule from ASG-Web to VirtualNetwork.

Answer

Place api01 in the same subnet as web01.

Question 13

An application running on a VM in a subnet must access an Azure Storage account. The security team wants the storage account to accept traffic only from that subnet, but they do not want a private IP address in the VNet and they do not want to change DNS records. What should the administrator configure?

Accepted Answer

Enable a service endpoint for Microsoft.Storage on the subnet and restrict the storage firewall to that subnet.. A service endpoint for Microsoft.Storage allows the subnet to send traffic to the storage account over the Azure backbone network using the storage account's public endpoint, without requiring a private IP address or DNS changes. The storage firewall then restricts access to only that subnet's traffic, meeting the security team's requirements.

Answer

Create a private endpoint and a private DNS zone for the storage account.

Answer

Allow access only from the VM public IP address.

Answer

Place the storage account in the same resource group as the VM.

Question 14

A team manages many application VMs and backend VMs. The VM IP addresses change whenever they are rebuilt, but the same traffic rule must always allow the app tier to reach the backend tier on TCP 8443. What should the administrator use in the NSG rule?

Accepted Answer

Application Security Groups for the app and backend VMs.. Application Security Groups (ASGs) allow you to group VMs logically and reference them directly in NSG rules without relying on static IP addresses. Since the VM IPs change on rebuild, ASGs ensure the NSG rule for TCP 8443 always applies to the correct app and backend tiers, regardless of IP changes.

Answer

Static private IP addresses for each virtual machine.

Answer

A user-defined route between the app and backend subnets.

Answer

An availability set for each tier.

Question 15

Two application teams created separate virtual networks so their workloads can communicate through VNet peering. VNet-A uses 10.20.0.0/16. VNet-B was created with 10.20.128.0/17. The peering request fails during validation. What is the best fix?

Accepted Answer

Change one VNet to use a non-overlapping address space.. VNet peering requires that the address spaces of the peered virtual networks do not overlap. VNet-A uses 10.20.0.0/16, which includes the entire range from 10.20.0.0 to 10.20.255.255. VNet-B uses 10.20.128.0/17, which is a subset of VNet-A's range (10.20.128.0 to 10.20.255.255). This overlap causes the peering validation to fail because Azure cannot route traffic between overlapping address spaces. Changing one VNet to a non-overlapping address space resolves the conflict.

Answer

Add an NSG rule to allow traffic between the two VNets.

Answer

Create a private endpoint in each VNet.

Answer

Attach a route table to both subnets.